Self-hosted patient surveys and health questionnaires

It depends on where you operate and what role you play, so confirm the list with your counsel and compliance lead before you scope the build. In the United States, the HIPAA Security Rule in 45 CFR Part 164 Subpart C is the baseline for covered entities and their business associates. Outside the US, or for EU-based providers and researchers, other regimes may add duties on top, including GDPR, NIS2 and the European Health Data Space Regulation. Each one can change hosting location, access control, breach reporting and retention, so map them to your sites and data flows early.

No. HITRUST is an optional assurance framework that some health organizations request from their vendors and partners. HITRUST CSF v11.9.0, available from 24 September 2026, is organized into 14 control categories with 49 control objectives and 156 control specifications. Assessments produce e1 and i1 certifications that last one year and r2 certifications that last two years. Independent HITRUST assessors issue these, not DeployOpen, so ask whether your contracts or customers actually require HITRUST before adding it to scope. For planning, the HITRUST CSF release advisory lists the current version.

NIST SP 800-66 Rev. 2, published in February 2024, is a practical implementation guide for the HIPAA Security Rule. It gives key activities, descriptions and sample questions for every standard. HHS lists it as informational, not legally binding, so it does not replace the regulation. Use it as a checklist when you map each safeguard to a configuration, role or log source in your self-hosted survey environment. Your compliance team should still confirm how each control maps to your own risk analysis.

No final rule had been published as of October 2026. HHS proposed a major Security Rule revision on 6 January 2025 (90 FR 898, RIN 0945-AA22), with comments due 7 March 2025. The latest Unified Agenda lists it under Long-Term Actions with final action projected for July 2027. Until then, the current rule applies. Plan your design so that stronger controls, such as multi-factor authentication, encryption and audit logging, can be added without rebuilding the platform, and confirm the status on the Federal Register proposed rule before each design review.

For penalties assessed on or after 28 January 2026, the inflation-adjusted range under 45 CFR 102.3 runs from $145 per violation, where there was no knowledge, to $2,190,294 per violation for uncorrected willful neglect. The calendar-year cap is $2,190,294. The amount depends on the culpability tier, how quickly the problem was corrected and the number of violations found. The practical lesson is that documented, timely corrective action changes the outcome, so keep evidence of risk analysis and remediation with the platform.

They can, depending on your role. NIS2 Annex I lists health as a sector of high criticality, covering healthcare providers, EU reference laboratories, medicinal product research and development, and certain medical device manufacturers. GDPR Articles 32 and 34 require appropriate security and breach notification to data subjects. On 3 September 2026, France's CNIL fined Hopital Prive de la Loire EUR 500,000 for external access to its patient record system without VPN or multi-factor authentication, and for access control that ignored the care team's need to know. Ask your data protection officer which of these apply and how external access is secured.

Regulation (EU) 2025/327, the European Health Data Space Regulation, sets rules for the use and secondary use of health data in the EU. Researchers and health organizations in scope should confirm how it governs data access, documentation and reuse of questionnaire outcomes. It does not replace GDPR, so both can apply at once. Because its obligations depend on your role and the data purpose, have legal counsel confirm applicability, then design the survey platform so that data location, access logs and export controls can meet those terms.

Yes, the Community Edition is free to download and self-host, and survey data stays on the server you choose. The license cost is only one line. Infrastructure, database administration, PHP and web server maintenance, backups, patching, and the staff who run the instrument all carry real costs. Because you host it, the HIPAA safeguards (access control, audit logging, encryption, backups and retention) become your obligations, and they need people and time. Ask any partner to separate one-time setup from recurring operations in the quote. If you prefer the hosted route, LimeSurvey Cloud publishes plan limits, including Basic at 1,000 responses per month with 1 admin user and Expert at 10,000 responses per year with 3 admins, but a hosted vendor still needs a business associate agreement before it receives ePHI.

The main drivers are the number of instruments, the systems they connect to, and how much validation the clinical and research teams need. Hosting is a recurring cost that depends on whether you run it in your own data center or a cloud account that will sign a business associate agreement. Integrations with an EHR, a patient portal or a research data store add mapping, testing and maintenance. Validation of questionnaires, role design, encryption setup, documented risk analysis and staff training each add effort. Ask for a fixed-scope quote that lists each instrument, each integration, the hosting model and the operations period separately, so you can see what recurs after go-live.

The duration depends on the scope agreed in writing, and this page does not state a fixed timeline. The biggest variables are the number of questionnaires, whether responses must flow into clinical systems, how many approvals the clinical and privacy teams require, and whether the hosting environment already exists. A pilot with one questionnaire and a single reporting view will move faster than a multi-site program with EHR links. Ask any partner to show the phases, the approval gates and what the client must provide at each stage before agreeing to a date.

The work needs a current data inventory that lists which questionnaires collect ePHI, which fields are identifiers, and where responses are stored and shared. It also needs clinical and compliance sign-off on question content, consent text and retention periods. IT must provide access to the hosting environment, identity provider, network paths and backup targets. Name one accountable owner for each of these: the clinical instrument owner, the privacy or compliance lead, the IT platform owner and the survey administrator. Without these owners, approvals stall and the risk analysis cannot be finished.

A team can do it alone if it already has security engineering skills for hosting, identity and encryption, and staff who can administer LimeSurvey and manage its database and updates. The heavier burden is the documentation. HIPAA requires you to assess each addressable implementation specification and record why you adopted it, adapted it or used an alternative measure, which means a documented risk analysis and written policies. NIST SP 800-66 Rev. 2 is a useful informational guide for mapping those activities to the Security Rule. If your team lacks these skills or capacity, a partner can prepare the controls and evidence, though the covered entity remains responsible for its own compliance.

No. There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, and that HHS does not endorse or recognize private certifications, which also do not stop HHS from later finding a violation. The Office for Civil Rights enforces the rule through complaints, compliance reviews and audits. Be wary of any vendor or partner that claims a HIPAA certificate. Ask instead for the evidence you can review: the risk analysis, the configuration baseline, access logs, the business associate agreement and the documented retention schedule. Independent assessments against a framework such as HITRUST are separate from HIPAA and are issued by external bodies.

When a survey collects ePHI for a covered entity, the company hosting or processing those responses is acting as a business associate. Under 45 CFR 164.314, the business associate contract must require the vendor to comply with the Security Rule, pass the same terms to any subcontractor that handles ePHI, and report security incidents, including breaches of unsecured PHI. Without that agreement in place, sending patient responses to a hosted survey service creates a compliance gap, regardless of how secure the service is. Before using any hosted survey service with ePHI, confirm the vendor will sign a business associate agreement, list its subprocessors and state the hosting region. Penalties for Security Rule failures are significant, with the inflation-adjusted civil money penalty for penalties assessed on or after January 28, 2026 reaching $2,190,294 per violation, with a calendar-year cap of the same amount.

Regulators and reviewers typically ask for evidence that access is limited to the roles that need it, that responses are encrypted in transit and at rest, that audit logs exist and are reviewed, and that retention and deletion follow a written schedule. They also ask how the organization handles emergency access, automatic logoff and incident reporting. Prepare these items as a binder of configuration records, policies and test results before an assessment starts. Note that HHS OCR's 2024 to 2025 audit program reviewed 50 covered entities and business associates on hacking and ransomware-related provisions, so backups and access controls deserve early attention.