@duffcloudservices/site-forms 0.2.0 → 0.3.0

package/README.md

@@ -255,6 +255,40 @@ pnpm --filter @duffcloudservices/site-forms test        # vitest --run
 pnpm --filter @duffcloudservices/site-forms type-check  # vue-tsc --noEmit
 ```
 
+## Compliance requirements for form submissions
+
+### Sensitive forms (`isSensitive: true`)
+
+Forms flagged as sensitive (law firm intake, HIPAA intake, any privilege-sensitive questionnaire) carry platform-enforced rules that form authors and site integrators must not override:
+
+1. **Notification emails suppress submission content.** When `isSensitive: true`, the portal notification email for a new submission contains only a portal link — never field values, names, or any submission body. This is required for attorney-client privilege (ABA Rule 1.6) and HIPAA confidentiality.
+
+2. **Access audit logging.** Every time a portal user opens a sensitive-form submission, the platform writes an audit log entry (`PortalAuditLog`, event: `submission_viewed`). This cannot be disabled.
+
+3. **Set via portal, not YAML.** The `isSensitive` flag lives in the `PortalSiteForms` table (managed via the portal Form Manager). It is not part of the `.dcs/forms/*.yaml` snapshot — the runtime itself has no concept of sensitivity.
+
+### Form version tracking
+
+Every submission row stores `formVersion` (the schema version of the form at submission time). If a form's fields change after submissions are collected, old submissions remain interpretable: the portal can reconstruct what was shown by looking up the version-keyed schema. This is required for compliance audit trails.
+
+### General form requirements
+
+All DCS-managed forms that collect personal data must:
+- Link a Privacy Policy URL in proximity to the submit action
+- Store `formVersionId`, submission timestamp, and submitter IP with every submission row (handled automatically by the platform)
+- Not collect unnecessary data fields (data minimization)
+
+### Intake questionnaires (attorneys, healthcare)
+
+Use the **Legal Intake — Standard** form template (created via the portal Form Manager → Templates) when building intake forms for law firms. This template:
+- Pre-populates the attorney-client privilege disclaimer and consent checkbox (non-removable)
+- Automatically sets `isSensitive: true`
+- Includes matter-type and adverse-parties fields for conflict screening
+
+For healthcare intake, mark the form as `FormKind: "hipaa"` so the submission handler applies PHI-aware redaction for notification emails.
+
+---
+
 ## Related docs
 
 - **Authoring guide** — [`.docs/forms/AUTHORING.md`](../../.docs/forms/AUTHORING.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duffcloudservices/site-forms",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shared <DcsForm/> runtime for DCS customer sites — renders managed form definitions from .dcs/forms/<formId>.yaml",
   "type": "module",
   "files": [