> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://knowledge.yourwatchtower.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Medical Forms & Sensitive Fields

# Medical Forms and Sensitive Fields

💡 Watchtower provides two ways to protect confidential information collected through Forms: **Medical Forms**, which protect an entire form response, and **Sensitive Fields**, which protect individual questions within any form.

Use Medical Forms when the complete response should be treated as medical or protected information. Use Sensitive Fields when a general operational form contains only one or more confidential answers, such as a patient name, contact information, signature, or other personal details.

> **Important:** These features support your agency's privacy and security practices, but your agency remains responsible for determining its legal and regulatory obligations, including whether HIPAA or another privacy framework applies.

## Medical Forms

Medical Forms are designed for workflows where the **entire submitted response** contains protected medical information. Examples may include patient care records, treatment documentation, exposure reports, or employee medical records.

Medical Forms appear separately under **Operations → Forms & Docs → Medical Forms**.

### Creating a Medical Form

To create a Medical Form:

1. Open **Operations → Forms & Docs → Medical Forms**.
2. Select the **+** button in the upper-right corner.
3. Add a form name, tags, audience, and the questions you would like to ask.
4. Select **Create Form**.

Only Admins can create new forms. The Medical Forms module must be enabled for your agency. Contact Watchtower Support if Medical Forms are not available in your account.

### Who Can View Medical Form Responses?

Medical Form access applies to the **whole response**, not only selected questions.

| Role | Medical Form response access |
| ---- |
| Read Only | Can view all responses within their agency |
| User | Can view only responses they submitted |
| Dispatcher | Can view all responses within their agency |
| Supervisor | Can view all responses within their agency |
| Admin | Can view all responses within their agency |

Medical Form answers are not included in notification emails or text messages. Authorized users must sign in to Watchtower to view the response.

### Business Associate Agreements

If your agency is subject to HIPAA and requires a Business Associate Agreement (BAA), an Admin can request one from the agency profile. Your agency should consult its legal or compliance advisor to determine whether a BAA is required.

## Sensitive Fields

Sensitive Fields protect an **individual question** within a form. They are useful when most of a form is operational information, but one or more answers require additional protection.

Common examples include:

* Patient health information (PHI)
* Personally identifiable information (PII)
* Names and contact details
* Signatures
* Medical notes
* Confidential addresses or locations

### Marking a Question as Sensitive

To protect a question:

1. Open the form in the **Form Builder**.
2. Find the question you want to protect.
3. Select the **lock icon** in the question's action bar.
4. Review the warning and type **sensitive** to confirm.
5. Save the form.

A lock icon appears beside protected questions when users submit or review the form.

> ⚠️ **This action cannot be undone.** Once a question is marked as Sensitive, it cannot be changed back. Existing answers to that question are field level encrypted in the background.

### Who Can View Sensitive Answers?

| Role | Sensitive answer access |
| ---- |
| Read Only | Can view sensitive answers on all responses within their agency |
| User | Can view sensitive answers only on responses they submitted |
| Dispatcher | Can view sensitive answers on all responses within their agency |
| Supervisor | Can view sensitive answers on all responses within their agency |
| Admin | Can view sensitive answers on all responses within their agency |

Users who can access another person's general form response may still see its non-sensitive answers, but its Sensitive Fields are hidden. Sensitive answers are decrypted only when an authorized user views the response inside Watchtower.

### How Sensitive Answers Are Protected

Sensitive answers receive additional application-level encryption on top of Watchtower's standard encryption at rest. They are also kept out of areas where the value could be copied, distributed, or analyzed outside the original response:

* Response summaries display **[Sensitive]** instead of the answer.
* CSV exports and PDF reports redact the answer.
* Email and text notifications do not expose the answer.
* Sensitive questions cannot be used in trend reports.
* Sensitive answers are excluded from search indexing.
* Sensitive questions cannot be selected as Summary Answers.
* Sensitive questions cannot be connected to Pulse status automations.

If a question is currently a Summary Answer or has an active Pulse connection, remove that configuration before marking it as Sensitive.

## Which Option Should I Use?

| Scenario | Recommended option |
| ---- |
| The entire form is a patient or medical record | Medical Form |
| A general incident form asks for a patient's name | Sensitive Field |
| A maintenance form includes an employee signature | Sensitive Field |
| The complete response should only be available to the submitter and authorized operational roles | Medical Form |
| Only selected answers need encryption and redaction | Sensitive Fields |

Medical Forms and Sensitive Fields can be used together when an individual question within a Medical Form requires the additional field-level encryption and redaction behavior.

## Need Help?

If you need Medical Forms enabled, need assistance requesting a BAA, or are unsure how to configure Sensitive Fields, contact Watchtower Support.