This may be a bit early to ask, but is HIPAA compliance for CS Forms on the product roadmap?
It’s been a number of years since I’ve done anything related to HIPAA, but I think that’ll be based on how you store that confidential data. Cornerstone Forms allows you to create any type of Post. If you had a non public Custom Post Type I think you would be okay. I would probably checkout how other HIPAA Compliant plugins work and see if you can recreate that in Cornerstone Forms with whatever you are trying to do. When it’s out we can answer more questions that may relate to your site too. Have a great day.