Masking PII on Forms

[THellebuyck11]

Is there a way to mask data on forms submitted from our websites? 

Context- we are a health insurance service provider and occassionally, visitors to our sites looking for support or coverage will submit a request form and include PII as part of the request. With Hubspot not being HIPAA compliant, I am wondering if there is a way to mask this type of data in order to prevent it being stored in Hubspot. 

[madbrain]

What are effective methods to ensure the secure handling and masking of Personally Identifiable Information (PII) submitted through online forms to enhance data security and service reliability?

[seanfalconer]

As mentioned in my prior post on this topic, my company can help with this use case.

We work with a lot of Hubspot customers to provide secure and compliant storage and management of regulated and sensitive customer data, including being able to mask and redact data depending on who the user is. We actually just launched a customer with this exact use case.

Skyflow is a data privacy vault company, we provide isolation, protection, governance, utility, and localization for sensitive customer data. We can integrate with Hubspot as well as other tools you might be using to execute workflows over sensitive data. 

Feel free to connect with me directly if you want to discuss how this could work in more details.

https://www.linkedin.com/in/seanf/

[seanfalconer]

Hi @THellebuyck11.

In full transparency, I work for Skyflow (https://www.skyflow.com), but I believe we can support your use case. We work with a lot of Hubspot customers to provide secure and compliant storage and management of regulated and sensitive customer data, including being able to mask and redact data depending on who the user is.

Skyflow is a data privacy vault company, we provide isolation, protection, governance, utility, and localization for sensitive customer data. We can integrate with Hubspot as well as other tools you might be using to execute workflows over sensitive data. We work with a lot of companies in the digital health space, helping provide technology to offload HIPAA and other privacy regulations.

Feel free to connect with me directly if you want to discuss how this could work in more details.

https://www.linkedin.com/in/seanf/

[THellebuyck11]

Thank you for your response. I think that you are not understanding my question. We do not currently or do we seek to store PII in Hubspot. However, when a visitor completes a form request for more information on our websites (hosted in Hubspot CMS), they might include PII in their submission despite our warning/disclaimer reminding them to not include this type of information. My question is whether Hubspot is able to detect that type of data and mask it or even remove it in order to avoid having it be stored in Hubspot (and avoid the compliance risk). 

[TomM2 · Accepted solution]

Ah! My apologies. I know HubSpot forms will stop you using specific PII questions for your field names, for example creating a form field for "Social security number". 

It doesn't automatically filter submissions though, so there's no way to automatically omit PII if it is submit in a form submission, the only way to have that data scrubbed from HubSpot would be to contact support and request they delete it. 

[TomM2]

Hey @THellebuyck11 it's actually against hubspot's TOS to store PII info on their CRM. While it is a secure platform, PII takes a few extra layers of delicacy with how they are handled and who they're visible to. HubSpot is not the place to store that info, if anyone has submit PII on a HS form you can contact hubspot to ask for it to be deleted, but if you wish to store and handle this you should look into a dedicated, encrypted system which could integrate with hubspot if you need it!