aia-website/www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv

1	gate_id	subject	verification_required	owner_role	evidence_source	status	approval_date	authorization_required
2	JF-01	Question properties	Types, required flags, defaults, exact options, visibility, internal identifiers, field-level PHI	Account owner + operations/privacy; Builder properties, no answers	Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A (262946078314059) submitted fields are PHI-protected; all other properties remain unverified	Partially verified — Form A field PHI protection only	2026-10-27	Separate batch authorization; no action authorized by this checklist
3	JF-02	Conditions	Show/hide, skip, calculations, update-field logic, conditional recipients and submission routing	Account owner; sanitized Conditions settings	Sanitized Builder configuration and owner approval; authorized runtime evidence where required	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
4	JF-03	Languages	EN/ES support, complete translation, default/selector, errors, conditional logic, confirmation and embed locale behavior	Account owner + fluent reviewers; Builder plus later authorized runtime tests; never assume `?language=es`	Sanitized Builder configuration and owner approval; authorized runtime evidence where required	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
5	JF-04	Emails	Notifications/autoresponders, recipient roles, subject/body/dynamic tags, attachments, reply-to, conditional routes, default IDs/links, inherited production recipients or defaults	Account/privacy owner; sanitized settings, no recipient addresses in public reports	Owner-verified 2026-10-27 ChatGPT WebUI/Jotform review: Form A uses the generic no-PHI notification template, has no submission-PDF attachment, and has approved recipient access; routing, headers/defaults, reply-to, autoresponder and delivery acceptance remain unverified	Partially verified — Form A generic template, recipient access and no PDF attachment	2026-10-27	Separate batch authorization; no action authorized by this checklist
6	JF-05	Thank-you behavior	Native confirmation, redirects, answer echo, all targets, HTTP POST forwarding	Account/privacy owner; Builder; submission-data POST to Astro/Contabo OFF	Sanitized Builder configuration and owner approval; authorized runtime evidence where required	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
7	JF-06	Integrations	Integrations, webhooks, exports, destinations, Google/analytics, protected-data flows	Account/security/privacy owner; actual integration inventory, not cloning assumptions	Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A has no webhooks or integrations; export/default/vendor behaviors beyond that reported review remain unverified	Verified — Form A webhooks/integrations absent	2026-10-27	Separate batch authorization; no action authorized by this checklist
8	JF-07	Security and availability	HIPAA/form/field protection, spam, availability, prefill, save/continue, access, retention, limits and duplicates	Account/privacy/security owner; settings and approved operational policy	Owner-verified 2026-10-27: privacy approval covers Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; other security/availability controls remain unverified	Partially verified — Form A approved configuration, access and retention scope	2026-10-27	Separate batch authorization; no action authorized by this checklist
9	JF-08	Embedding	Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback	Account/hosting/accessibility owners; exported code and later authorized runtime evidence	Sanitized Builder configuration and owner approval; authorized runtime evidence where required	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
10	JF-09	Controlled synthetic acceptance	Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary	Later separately authorized isolated form/environment; never real patient data	Sanitized Builder configuration and owner approval; authorized runtime evidence where required	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
11	OA-01	Intake/operations	Minimum fields, required flags/contact preference consistency, follow-up/callback expectations, Tour/fundraising scope	Intake/operations	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
12	OA-02	Clinical leadership	Eligibility, service/evaluation availability, private-pay Social Club distinction, referral boundary and approved claims	Clinical leadership	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
13	OA-03	Jotform account owner	JF-01–08, blank-form creation, actual new IDs/configuration and preservation of all existing forms	Jotform account owner	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
14	OA-04	English/Spanish reviewer	Labels, errors, instructions, confirmations and locale switching; no automatic translation approval	English/Spanish reviewer	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
15	OA-05	Privacy/legal/security	Protected fields, generic email/headers/recipients, embeds/referrers, vendor flows, access/retention and tracking boundaries	Privacy/legal/security	Owner-verified 2026-10-27 privacy approval for Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; embed/referrer runtime review and tracking boundaries remain open	Partially verified — Form A configuration, access and retention scope	2026-10-27	Separate batch authorization; no action authorized by this checklist
16	OA-06	Marketing	Deferred attribution categories and redesigned successful-submission semantics	Marketing	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
17	OA-07	Hosting owner	Static/API separation, compile/deploy gates, CSP/referrer/log policy, preview isolation and fallback topology	Hosting owner	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
18	OA-08	Release owner	Phase 10 integration activation, go/no-go, artifact/vendor rollback and deployment	Release owner	Dated owner approval with scope and sanitized supporting evidence	Pending/Unverified		Separate batch authorization; no action authorized by this checklist
19	INV-01	Supplied roster provenance and remaining verification	Complete 27-ID roster received and uniqueness checked; verify uncertain generic titles and relevant operational classification with account owner without inferring usage or retrieving submissions	Jotform account owner	Owner-supplied read-only connector roster; contract v1.2 section 3 lists all 27 unique IDs; individual roster no longer outstanding; new-form configuration and usage verification pending	Pending/Unverified		Read-only metadata review authorization; no account mutation