Notification exposes or omits an expected answer

When an answer is visible unexpectedly or missing from an email, inspect how that exact message was built. Field privacy, recipient configuration, message text and attachments can all affect the result.

Identify the affected message

Note whether it is a signing invitation, a reminder, a respondent confirmation or an internal notification. Find the response that produced it and compare the recipient with the configured address or mapped email field.

An owner preview is not the delivered email. Use a synthetic response and the actual intended recipient role when checking the result. Keep the test values distinct so you can tell whether an answer came from the response, a template, or a manually written message.

If a sensitive answer is visible

1. Review the question's PHI selection in HIPAA setup.
2. Check whether the visible value was manually placed in the subject or body.
3. Inspect attachments separately; a PDF can contain information omitted from the covering message.
4. Check whether a link opens the detailed record with access intended for that person.
5. Review fixed team recipients and any broader mailbox or folder sharing.

Correct the configuration and repeat a synthetic test. Do not assume changing one notification retroactively changes already delivered messages or files held by recipients.

If an answer is missing

Masked PHI can be expected behavior. Confirm the recipient's role and the information they need before including more content. A short alert with a permitted record link may be more suitable than copying the entire response into email.

For a report or Sheet export, inspect that connection's sensitive-field choices. The report path and a Google Form's separately linked Sheet are distinct. Use the sync guide to identify the route.

Check the complete result

Review subject, body, links, attachment names and attachment contents together. A subject can identify a request without including a patient's condition or an employee's private details. A broadly shared Drive folder can expose a file even when the notification itself is appropriately brief.

Give authorized staff the record access needed for their task through collaboration settings, rather than adding all answers to every notification. For detailed setup, use PHI controls and email configuration.

If an actual disclosure needs investigation, follow your organization's incident process and contact the service through its current support route. A public support post should contain the symptom and configuration context, not the sensitive response or private link.