From eecb5826652f77f420c81c3bb20f30c911f9d43d Mon Sep 17 00:00:00 2001 From: Jeffrey Hales Date: Tue, 27 Oct 2026 19:13:59 -0700 Subject: [PATCH] docs(forms): record Form A privacy verification --- ...-jotform-implementation-plan-2026-10-18.md | 14 +++++++-- ...jotform-integration-contract-2026-10-18.md | 30 ++++++++++++++----- ...form-verification-checklist-2026-10-18.csv | 10 +++---- 3 files changed, 38 insertions(+), 16 deletions(-) diff --git a/www/reports/phase-9-jotform-implementation-plan-2026-10-18.md b/www/reports/phase-9-jotform-implementation-plan-2026-10-18.md index 944de85..2ce255e 100644 --- a/www/reports/phase-9-jotform-implementation-plan-2026-10-18.md +++ b/www/reports/phase-9-jotform-implementation-plan-2026-10-18.md @@ -1,6 +1,6 @@ # P9-03 source-specific implementation plan -Date: **2026-10-18** · Plan version **1.2 revision 2026-10-21** · Governing contract: [P9-03-JF-2026-10-18 v1.2](phase-9-jotform-integration-contract-2026-10-18.md). +Date: **2026-10-18** · Plan version **1.3 revision 2026-10-27** · Governing contract: [P9-03-JF-2026-10-18 v1.3](phase-9-jotform-integration-contract-2026-10-18.md). **Planning only. Do not execute any batch from this document without separate authorization.** Phase 9 establishes decisions and bounded implementation authority. Phase 10 retains final production integration acceptance, rollback and cutover. The user stages, signs and pushes. @@ -12,6 +12,12 @@ Verified `faithful-astro-migration`, HEAD `59911eb929579af7bcd6c42de6476128dab62 Current source-manifest construction confirmed nine eligible enquiry routes and corresponding existing generated HTML forms. Source files still match Git. No build/browser/submission test was run for this documentation-only task. Counts below are verified route mapping plus the signed checkpoint's accepted publication baseline, not new full-suite results. +### Form A configuration update — 2026-10-27 + +The owner reports that new **Form A — General Enquiries** (`262946078314059`) has field PHI protection; a generic notification without submitted values or PDF attachment; no webhooks or integrations; and privacy approval for that direct-to-Jotform configuration. This is owner-confirmed evidence from a ChatGPT WebUI/Jotform review, not a repository-side Builder audit. It does not authorize production activation, external submissions, analytics, or advertising. + +The confirmation is limited. Recipient access and Form A retention/deletion controls are owner-verified, while exact role/retention-policy details remain account-policy information outside this repository. Exact conditional logic, default/reply-to/header behavior, redirects/confirmation, autosave/save-and-continue, availability/spam settings, full EN/ES runtime acceptance, and synthetic delivery acceptance remain pending. Forms B and C are not covered. + | Inventory ID | Route | Source content under `www/src/content/pages` | Owning component under `www/src/components` | Target | |---|---|---|---|---| | F-001 | `/contact` | `en/contact.mdx` | `pages/ContactPage.astro` → `ContactForm.astro` | A EN | @@ -97,7 +103,7 @@ Drawer decision is a prerequisite for replacing its live content: retain timer o ## 4. Builder review and blank-form creation prerequisites -Use [JF-01–09 and owner gates](phase-9-jotform-verification-checklist-2026-10-18.csv). All start Pending/Unverified. Verify the blank-form Builder settings in A/B before any synthetic test; no existing form is a source for inheritance. Runtime portions of JF-03/08 remain open until D. +Use [JF-01–09 and owner gates](phase-9-jotform-verification-checklist-2026-10-18.csv). Form A has the limited owner-confirmed configuration portions recorded in the 2026-10-27 ledger update; all remaining verification starts Pending/Unverified. Verify the blank-form Builder settings in A/B before any synthetic test; no existing form is a source for inheritance. Runtime portions of JF-03/08 remain open until D. Before any creation, approve an account process that creates exactly three disabled blank forms, prevents public access and live notifications, and records the new IDs only after the account owner confirms the forms are isolated. Configure minimum fields, PHI protection, generic notifications, confirmation behavior and no-forwarding settings explicitly. Do not copy/import fields, settings or submissions from existing forms. If safe isolation cannot be established, stop before creation. @@ -215,7 +221,7 @@ Source changes require a newly named offline reconciliation using explicit final First recommended authorized batch: **Batch A**, final blank-form specifications and owner field approval, using the now-complete owner-supplied 27-asset roster as historical context only. First safe **code** batch is C's off/mock contact slice after its explicit authorization; it can avoid external account changes while B is pending, but cannot invent Jotform settings. -Owner ledger OA-01–08 and JF-01–09 are all Pending/Unverified in the companion CSV. Pending facts include actual new-form question IDs/types/defaults/options, PHI flags, conditional routing, real translations/locale URLs, email recipients/templates, integrations/webhooks/exports, thank-you/POST behavior, security/retention/access, blank-form isolation and supported success signaling. No new production embed ID exists. Final field approval and creation of A/B/C are pending. Tour/event/fundraising separation must be retained. +The companion CSV records limited owner-confirmed Form A portions of JF-01, JF-04, JF-06, JF-07 and OA-05. Pending facts still include actual question IDs/types/defaults/options, conditional routing, real translations/locale URLs, default email behavior, thank-you/POST behavior, blank-form isolation and supported success signaling. Form A recipient access and retention/deletion are owner-verified; detailed role and retention-policy records remain outside the repository. Form A now exists but has no production-activation approval; B and C remain pending. Tour/event/fundraising separation must be retained. Any approval record must identify approver role, date, exact form/environment/version, sanitized evidence and scope. An account label ENABLED, a BAA, a successful static build or a generic vendor help article cannot close these gates. Keep the real screen-reader, authorized visual/non-Chromium, fluent-language, clinical, financial and policy/source-provenance requirements from SESSION_HANDOFF. @@ -228,3 +234,5 @@ Validation passed: local Markdown links, balanced code fences and whitespace; 18 Roster reconciliation, version 1.1: only the October 18 contract, plan and checklist were updated. The individual inventory gap is closed by owner-supplied metadata; no JF or owner approval is closed and no implementation batch is executed. Decision revision, version 1.2, 2026-10-21: the owner superseded the working-copy proposal with three new blank Jotform forms. Batch A now finalizes specifications, Batch B creates the three disabled forms only after explicit mutation authorization, and later batches retain off/mock/live safeguards. The 27-form legacy roster and all existing workflows remain historical/operationally independent. No source components, tests, Jotform forms or production systems were changed. + +Version 1.3, 2026-10-27: records owner-confirmed Form A configuration evidence from the owner’s ChatGPT WebUI/Jotform review. Form A field PHI protection, the generic no-PHI notification template, absence of submission-PDF attachment, absence of webhooks/integrations, and privacy approval are confirmed for that form’s configuration scope. The update records recipient access and retention/deletion as owner-verified for Form A. It does not close conditional routing, runtime acceptance, live activation, Forms B/C configuration or any broader P9-03/P9-07 gate. diff --git a/www/reports/phase-9-jotform-integration-contract-2026-10-18.md b/www/reports/phase-9-jotform-integration-contract-2026-10-18.md index 9414440..18536fe 100644 --- a/www/reports/phase-9-jotform-integration-contract-2026-10-18.md +++ b/www/reports/phase-9-jotform-integration-contract-2026-10-18.md @@ -1,10 +1,10 @@ # P9-03 Jotform integration contract -**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.2 · **Decision revision:** 2026-10-21 +**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.3 · **Decision revision:** 2026-10-27 **Status: documented planning architecture; implementation and activation NOT authorized.** -This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised on October 21. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms without changing the three-form architecture or pending approvals. No future commit SHA is invented. +This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 27. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence. No future commit SHA is invented. Companions: [source-specific implementation plan](phase-9-jotform-implementation-plan-2026-10-18.md), [verification and approval ledger](phase-9-jotform-verification-checklist-2026-10-18.csv). @@ -40,6 +40,18 @@ Evidence classes must remain distinct: - GA4, Google Ads, GTM, remarketing, enhanced conversions and user-data collection remain disabled/unapproved. - Contabo static hosting and approved non-PHI API functions, with Raspberry Pi fallback, remain planning preferences—not verified topology or deployment instructions. +### 2.1 Form A owner-confirmed configuration evidence — 2026-10-27 + +The owner supplied the following **Form A-specific configuration evidence** after a ChatGPT WebUI/Jotform review. The repository did not access the Jotform account, inspect submissions, or independently audit the Builder. Treat this as owner-confirmed evidence, not a blanket HIPAA certification and not proof of equivalent settings on Forms B, C, or any legacy form. + +- **Form A — General Enquiries** has form ID `262946078314059`. The ID is approved only for the gated Form A integration described in the current implementation and is **not production-activation authority**. +- Form A's submitted fields are confirmed PHI-protected. +- Form A's staff notification uses the approved generic, no-PHI template. It does not include submitted answers or a submission PDF attachment. +- Form A has no webhooks or third-party integrations configured. +- The owner reports privacy approval for these Form A controls and the direct-to-Jotform boundary. + +This confirmation includes owner-verified notification-recipient access and Form A submission-retention controls. The exact authorized roles and retention period remain account-policy information and are intentionally not copied into the repository. Conditional routing, reply-to/default-header behavior, autoresponder policy, redirect/thank-you behavior, EN/ES runtime behavior, spam/availability settings, and successful synthetic submission remain pending. It does not enable Form A, approve an iframe in a production artifact, or close P9-03, P9-05, P9-07, or Phase 10 release approval. Forms B and C remain separately planned and unverified. + ## 3. Account assets and accounting for all 27 The user reports that all 27 assets were classified and ENABLED during the October 18 connector inspection, without retrieving submitted answers. Enabled is an observed status at that time, not approval to use the asset. @@ -89,7 +101,7 @@ Classifications are the **owner-supplied planning categories**, not verified Jot | `242236946264158` | Administration | AIA Technology Request Form - Scottsdale | | `240728578023156` | Administration | AIA Maintenance Request Form - Scottsdale | -Validation: **27 rows, 27 unique IDs**. The four previously identified assets are included; the other 23 are now individually listed. The individual roster is no longer outstanding. This fills the metadata inventory gap only: JF-01 through JF-09 and all owner approvals remain pending. The October 17 worksheet and source evidence are preserved unchanged. +Validation: **27 rows, 27 unique IDs**. The four previously identified assets are included; the other 23 are now individually listed. The individual roster is no longer outstanding. This fills the metadata inventory gap only. Form A's limited 2026-10-27 configuration evidence is recorded in section 2.1 and the ledger; all other JF and owner approval scope remains pending. The October 17 worksheet and source evidence are preserved unchanged. `250727122848156` is a **historical reference ID only**, never an approved production embed ID or blank-form source. Preserve every listed clinical, agreement, billing, event, HR, administrative and other operational workflow; no classification permits modification, repurposing or deletion. This roster contains no submitted answers, patient data, submission metadata or inferred field-level configuration. @@ -172,9 +184,9 @@ Tour's actual CTA currently goes to `/client-consultation` (B destination). A is `/lp/early-intervention` and the provisional local `/client-consultation` substitution remain P9-01 decisions. Campaign landing pages outside this repository are out of scope. Phone/email legacy-target issues in the inventory remain unresolved; no target is silently replaced. -## 6. Verification gates — all Pending / Unverified +## 6. Verification gates — current disposition -The connector supplied titles, IDs, enabled status, timestamps, labels and limited summaries—not a full Builder audit. Each gate must record the exact new-form ID when one exists, reviewer, date, sanitized evidence and disposition. A historical-form finding does not automatically pass a newly created blank form's gate. +The connector supplied titles, IDs, enabled status, timestamps, labels and limited summaries—not a full Builder audit. Each gate must record the exact form ID when one exists, reviewer, date, sanitized evidence and disposition. A historical-form finding does not automatically pass a newly created blank form's gate. The Form A owner-confirmed portions are recorded below and in the CSV ledger; every unlisted portion remains pending. | Gate | Required verification | Owner / evidence | |---|---|---| @@ -188,7 +200,7 @@ The connector supplied titles, IDs, enabled status, timestamps, labels and limit | JF-08 | Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback | Account/hosting/accessibility owners; exported code and later authorized runtime evidence | | JF-09 | Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary | **Later separately authorized** isolated form/environment; never real patient data | -No JF gate has passed. Read-only Builder review may complete configuration portions of JF-01–08; runtime portions remain pending until explicitly authorized. Generic vendor documentation does not close a gate. The [CSV ledger](phase-9-jotform-verification-checklist-2026-10-18.csv) also tracks owner approvals and the supplied complete roster and its pending configuration/usage verification. +For Form A only, JF-01 (field PHI protection), JF-04 (generic no-PHI notification, recipient access and no PDF attachment), JF-06 (no webhooks/integrations), and the corresponding privacy/access/retention portions of JF-07/OA-05 are owner-verified as of 2026-10-27. Each is **partial**: the remaining verification listed in its row is still required. JF-02, JF-03, JF-05, JF-08 and JF-09 remain pending. Read-only Builder review may complete other configuration portions; runtime portions remain pending until explicitly authorized. Generic vendor documentation does not close a gate. The [CSV ledger](phase-9-jotform-verification-checklist-2026-10-18.csv) tracks the exact scope, remaining work and supplied complete roster. ## 7. Future integration-mode contract @@ -212,7 +224,7 @@ Answers must not enter Astro handlers, Contabo endpoints, unreviewed webhooks, r ## 8. Initial notification contract -Proposed exact initial template (activation still pending JF-04 and privacy approval): +The following generic template is owner-verified for Form A; activation and delivery acceptance remain pending: ```text Subject: New AIA form submission @@ -223,7 +235,7 @@ Sign in to AIA's authorized Jotform account to review it. No dynamic answer tags, PDFs or other submission attachments, respondent reply-to, patient/family names, submitted email/phone, clinical data, submission ID, individual submission/edit link, unreviewed CC/BCC or automatic forwarding of responses. Do not disable PHI protection to expose a field. Check sender, headers, footer, hidden/default fields and all-field tokens as well as visible body. Arizona-local date/time and source/campaign labels are **deferred**, not optional additions for the implementer. No respondent autoresponder is authorized by this generic staff notification. -Jotform's [HIPAA email guidance](https://www.jotform.com/help/504-how-to-use-notification-and-autoresponder-emails-in-hipaa-accounts/) describes excluding protected fields; its [field-protection guidance](https://www.jotform.com/help/518-How-to-set-PHI-fields-on-your-forms/) requires proper field classification. These do not prove a current template is safe. Inspect the actual copy, approved recipient roles and delivered synthetic message later. Never create a Contabo webhook receiving full answers to generate a generic email. +Jotform's [HIPAA email guidance](https://www.jotform.com/help/504-how-to-use-notification-and-autoresponder-emails-in-hipaa-accounts/) describes excluding protected fields; its [field-protection guidance](https://www.jotform.com/help/518-How-to-set-PHI-fields-on-your-forms/) requires proper field classification. The owner-verified Form A template, PHI protection, recipient access and retention controls are recorded in section 2.1; headers/defaults and delivered synthetic-message behavior still require review. Never create a Contabo webhook receiving full answers to generate a generic email. ## 9. Blank-form creation safety and success measurement @@ -267,3 +279,5 @@ Version 1.0, 2026-10-18: records the owner's three-form/direct-Jotform/no-bookin Version 1.1, 2026-10-18: adds the complete owner-supplied 27-ID roster and distinguishes reported metadata from planning classifications. Removes superseded missing-roster statements. Architecture, source-template restrictions, implementation authority and pending approval statuses are unchanged. No Jotform access or mutation occurred during this reconciliation. Version 1.2, 2026-10-21: records the owner's decision to create three new blank Jotform forms from scratch. Supersedes the earlier working-copy proposal for `250727122848156`; preserves that ID as historical reference evidence only. Adds the owner-reported legacy-form remediation summary, retains all existing workflows, changes Batch B and OA-03 to blank-form creation, and leaves JF-01–09 and all owner approvals Pending/Unverified. No Jotform access or mutation occurred during this documentation revision. + +Version 1.3, 2026-10-27: records owner-confirmed Form A (`262946078314059`) evidence from the owner’s ChatGPT WebUI/Jotform review: field PHI protection, the generic no-PHI notification template, no submission-PDF attachment, no webhooks/integrations, and privacy approval for that configuration scope. It marks only the corresponding Form A portions of JF-01, JF-04, JF-06, JF-07 and OA-05 in the ledger. Recipient access and retention are owner-verified; routing/defaults, runtime acceptance and activation remain open; no account access, mutation, submission, deployment or tracking occurred in this repository update. diff --git a/www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv b/www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv index 8f23785..cf72cc2 100644 --- a/www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv +++ b/www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv @@ -1,18 +1,18 @@ gate_id,subject,verification_required,owner_role,evidence_source,status,approval_date,authorization_required -JF-01,Question properties,"Types, required flags, defaults, exact options, visibility, internal identifiers, field-level PHI","Account owner + operations/privacy; Builder properties, no answers",Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist +JF-01,Question properties,"Types, required flags, defaults, exact options, visibility, internal identifiers, field-level PHI","Account owner + operations/privacy; Builder properties, no answers",Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A (262946078314059) submitted fields are PHI-protected; all other properties remain unverified,Partially verified — Form A field PHI protection only,2026-10-27,Separate batch authorization; no action authorized by this checklist JF-02,Conditions,"Show/hide, skip, calculations, update-field logic, conditional recipients and submission routing",Account owner; sanitized Conditions settings,Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist JF-03,Languages,"EN/ES support, complete translation, default/selector, errors, conditional logic, confirmation and embed locale behavior",Account owner + fluent reviewers; Builder plus later authorized runtime tests; never assume `?language=es`,Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist -JF-04,Emails,"Notifications/autoresponders, recipient roles, subject/body/dynamic tags, attachments, reply-to, conditional routes, default IDs/links, inherited production recipients or defaults","Account/privacy owner; sanitized settings, no recipient addresses in public reports",Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist +JF-04,Emails,"Notifications/autoresponders, recipient roles, subject/body/dynamic tags, attachments, reply-to, conditional routes, default IDs/links, inherited production recipients or defaults","Account/privacy owner; sanitized settings, no recipient addresses in public reports","Owner-verified 2026-10-27 ChatGPT WebUI/Jotform review: Form A uses the generic no-PHI notification template, has no submission-PDF attachment, and has approved recipient access; routing, headers/defaults, reply-to, autoresponder and delivery acceptance remain unverified","Partially verified — Form A generic template, recipient access and no PDF attachment",2026-10-27,Separate batch authorization; no action authorized by this checklist JF-05,Thank-you behavior,"Native confirmation, redirects, answer echo, all targets, HTTP POST forwarding",Account/privacy owner; Builder; submission-data POST to Astro/Contabo OFF,Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist -JF-06,Integrations,"Integrations, webhooks, exports, destinations, Google/analytics, protected-data flows","Account/security/privacy owner; actual integration inventory, not cloning assumptions",Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist -JF-07,Security and availability,"HIPAA/form/field protection, spam, availability, prefill, save/continue, access, retention, limits and duplicates",Account/privacy/security owner; settings and approved operational policy,Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist +JF-06,Integrations,"Integrations, webhooks, exports, destinations, Google/analytics, protected-data flows","Account/security/privacy owner; actual integration inventory, not cloning assumptions",Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A has no webhooks or integrations; export/default/vendor behaviors beyond that reported review remain unverified,Verified — Form A webhooks/integrations absent,2026-10-27,Separate batch authorization; no action authorized by this checklist +JF-07,Security and availability,"HIPAA/form/field protection, spam, availability, prefill, save/continue, access, retention, limits and duplicates",Account/privacy/security owner; settings and approved operational policy,"Owner-verified 2026-10-27: privacy approval covers Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; other security/availability controls remain unverified","Partially verified — Form A approved configuration, access and retention scope",2026-10-27,Separate batch authorization; no action authorized by this checklist JF-08,Embedding,"Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback",Account/hosting/accessibility owners; exported code and later authorized runtime evidence,Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist JF-09,Controlled synthetic acceptance,"Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary",Later separately authorized isolated form/environment; never real patient data,Sanitized Builder configuration and owner approval; authorized runtime evidence where required,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist OA-01,Intake/operations,"Minimum fields, required flags/contact preference consistency, follow-up/callback expectations, Tour/fundraising scope",Intake/operations,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist OA-02,Clinical leadership,"Eligibility, service/evaluation availability, private-pay Social Club distinction, referral boundary and approved claims",Clinical leadership,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist OA-03,Jotform account owner,"JF-01–08, blank-form creation, actual new IDs/configuration and preservation of all existing forms",Jotform account owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist OA-04,English/Spanish reviewer,"Labels, errors, instructions, confirmations and locale switching; no automatic translation approval",English/Spanish reviewer,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist -OA-05,Privacy/legal/security,"Protected fields, generic email/headers/recipients, embeds/referrers, vendor flows, access/retention and tracking boundaries",Privacy/legal/security,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist +OA-05,Privacy/legal/security,"Protected fields, generic email/headers/recipients, embeds/referrers, vendor flows, access/retention and tracking boundaries",Privacy/legal/security,"Owner-verified 2026-10-27 privacy approval for Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; embed/referrer runtime review and tracking boundaries remain open","Partially verified — Form A configuration, access and retention scope",2026-10-27,Separate batch authorization; no action authorized by this checklist OA-06,Marketing,Deferred attribution categories and redesigned successful-submission semantics,Marketing,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist OA-07,Hosting owner,"Static/API separation, compile/deploy gates, CSP/referrer/log policy, preview isolation and fallback topology",Hosting owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist OA-08,Release owner,"Phase 10 integration activation, go/no-go, artifact/vendor rollback and deployment",Release owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist